Academy › Publishing › Domain and email
The three signatures that keep your email out of spam
Set up SPF, DKIM, and DMARC in that order, starting DMARC in monitor mode, so your emails have a better shot at landing in the inbox instead of spam.
By Yodai · Published on September 6, 2026 · Updated on October 12, 2026
You write from your own domain, not the same old Gmail address, and your inbox is all set up. You send an email and it goes out... but it doesn't arrive. Or it does, and lands in the spam folder.
You've experienced it: you send ten quotes, and a week later three clients email you to say they never saw them, that they were sitting in their spam folder.
The problem isn't your text or your subject line. It's that your customer's email server, Gmail, Outlook, iCloud, doesn't know you yet, and before it puts your email in the main inbox, it checks your domain's signatures. If they're missing or set up wrong, it's easier for the server to make the call for you: straight to spam, or rejected outright. Gmail, for example, has required since 2024 that anyone sending mail have at least SPF or DKIM, plus DMARC for anyone sending 5,000 emails a day or more.
The three signatures, one by one
Each signature answers a different question the receiving server asks. The first: who's allowed to send mail on your behalf? The second: has anyone tampered with this email along the way? The third: if the first two fail, what do I do with this email, and who do I tell?
All three live in the same place: your domain's DNS panel, the same one where you already pointed your website and email. They're added as DNS records; DKIM also needs to be turned on in your email provider, as you'll see below.
The first signature: the list of who can speak for you
An SPF record is a list, written into your domain, with the names of the servers allowed to send email on your behalf. If an email arrives claiming to be from you but comes from a server that's not on that list, the receiver gets suspicious.
This is where people get tripped up: it's not just your email provider. If you use a booking platform that sends confirmations from your domain, or your website sends automatic notices on your behalf, those services need to be authorized too, usually by adding them to this list or through their own signature (the second one, below); each one tells you which in their help docs. Miss one, and those specific emails are the ones that land in spam, while everything else gets through fine.
The second signature: the seal stamped on the email
DKIM is a digital signature your email provider attaches to every message that leaves your inbox, without you doing anything when you write it. The receiving server reads it and checks that the content hasn't been altered along the way: not the subject line, not the body, not the sender.
You don't write it yourself, you turn it on. Your email provider gives you a code, a long string of letters and numbers, and you paste it into your DNS as another text record. Once it's set, DKIM signs on its own, email after email.
The third signature: who decides if something goes wrong
DMARC combines the two above and adds one instruction: if an email claims to be from you but fails both SPF and DKIM for your domain, what should happen to it? It can let it through anyway, send it to spam, or reject it outright. It also asks the providers receiving your mail to send you a regular report, usually daily, showing who sent mail on your behalf and whether it passed the filter.
That report is what tells you whether you have an impersonation problem, someone sending spam pretending to be your business, or whether you're simply missing a server from your SPF list.
- 1SPF first
Add the record with every server that sends on your behalf: your email provider, and any platform that sends confirmations or invoices from your domain. - 2DKIM second
Turn it on in your email provider's panel and copy the key it gives you into your DNS. Without this step, your email goes out without your domain's signature even if SPF is set up right. - 3DMARC in monitor mode
Add the record with the policy set to "don't do anything yet" (none), and an address to receive the reports. That way you see who's failing before you block anything. - 4Tighten the policy once the reports are clean
Once the reports go a while without showing any of your own emails failing (Google says to watch them for at least a week; two or three weeks is plenty), switch the policy to quarantine, first for a portion of your mail, and later to reject.
- You see in the report who's failing, without losing any of your emails along the way
- You need at least a week of reports to get the full picture
- Shuts down any impersonation right away
- If a server is missing from your SPF, and that server doesn't sign with your DKIM either, your own legitimate emails get rejected
Which one to pick: Always start in monitor mode. Move toward blocking gradually, quarantine first, then reject, and only once the reports have gone at least a week, ideally two or three, without showing any of your own emails failing.
With all three signatures in place, the next step is to send a real email and check that it lands properly before you send anything to your whole list.
- Your SPF record is set up, with every server that sends on your behalf.
- DKIM is turned on with the key from your email provider.
- DMARC is in monitor mode, with the address where you get the reports.
- You know which report to check before you move DMARC to blocking.
In Yodai you connect the domain you already have to your site, and it stays registered where it is, in your name. See how your own domain for your website works.
NextSend one test email before you send a hundred